Systems and methods for application control in virtualized environments
Described systems and methods enable enforcing application control remotely and automatically, on a relatively large number of client systems (e.g., a corporate network, a virtual desktop infrastructure system, etc.). An application control engine executes outside a virtual machine exposed on a client system, the application control engine configured to enforce application control within the virtual machine according to a set of control policies. When a policy indicates that a specific process is not allowable on the respective client system, the app control engine may prevent execution of the respective process. To assist in data gathering and/or other activities associated with application control, some embodiments temporarily drop a control agent into the controlled virtual machine.
1. A computer system comprising at least one hardware processor configured to execute a set of guest virtual machines (VM) and to further execute an application control engine, the application control engine executing outside the set of guest VMs, the application control engine configured to:
detect an event indicative of a launch of a target process within a guest VM of the set of guest VMs, wherein the event comprises an item selected from a group consisting of setting up a virtual memory space for the target process, and writing to a data structure used by the at least one hardware processor to perform memory address translations for the target process;
in response to detecting the event, determine according to an application control policy whether the target process is allowed to execute on the computer system, wherein the application control policy maps allowed processes to users of the computer system; and
in response to determining whether the target process is allowed to execute, when the target process is not allowed to execute, prevent an execution of the target process.
2. The computer system of claim 1 , wherein the event comprises writing to the data structure.
3. The computer system of claim 1 , wherein detecting the event comprises detecting an attempt to write to a control register of the at least one hardware processor, the control register configured to store a pointer to the data structure.
4. The computer system of claim 1 , wherein the application control engine is further configured to maintain a list of processes executing within the guest VM, and wherein detecting the event comprises determining according to a value read from a control register of the at least one hardware processor whether the target process is on the list of processes.
5. The computer system of claim 1 , wherein the application control engine is further configured, in response to detecting the event, to identify the target process according to a set of identifying features of the target process, and wherein identifying the target process comprises:
in response to detecting the event, inserting a control agent into the guest VM, the control agent configured to determine the identifying features; and
in response to the control agent determining the identifying features, removing the control agent from the guest VM.
6. The computer system of claim 1 , wherein inserting the control agent comprises:
writing a driver loader to a memory of the computer system, the driver loader configured to load a control driver into the guest VM, the control driver configured to determine the identifying features; and
configuring the target VM to switch, when a computer program executing within the guest VM issues a system call, from executing the computer program to executing the driver loader.
7. The computer system of claim 1 , wherein preventing the execution of the target process comprises changing a value of an instruction pointer of the at least one hardware processor, to alter an execution flow of the target process.
8. The computer system of claim 1 , wherein determining whether the target process is allowed to execute on the computer system comprises:
transmitting an indicator of the target process to a remote server computer system; and
in response, receiving from the server computer system a policy indicator indicating whether the target process is allowed to execute on the computer system.
9. A method comprising employing at least one hardware processor of a client system to execute an application control engine outside of a set of guest virtual machines (VM) exposed on the client system, wherein executing the application control engine comprises:
detecting an event indicative of a launch of a target process within a guest VM of the set of guest VMs, wherein the event comprises an item selected from a group consisting of setting up a virtual memory space for the target process, and writing to a data structure used by the at least one hardware processor to perform memory address translations for the target process;
in response to detecting the event, determining according to an application control policy whether the target process is allowed to execute on the client system, wherein the application control policy maps allowed processes to users of the client system; and
in response to determining whether the target process is allowed to execute, when the target process is not allowed to execute, preventing an execution of the target process.
10. The method of claim 9 , wherein the event comprises writing to the data structure.
11. The method of claim 9 , wherein detecting the event comprises detecting an attempt to write to a control register of the at least one hardware processor, the control register configured to store a pointer to the data structure.
12. The method of claim 9 , wherein the application control engine is configured to maintain a list of processes executing within the guest VM, and wherein detecting the event comprises determining according to a value read from a control register of the at least one hardware processor whether the target process is on the list of processes.
13. The method of claim 9 , wherein executing the application control engine further comprises, in response to detecting the event, identifying the target process according to a set of identifying features of the target process, and wherein identifying the target process comprises:
in response to detecting the event, inserting a control agent into the guest VM, the control agent configured to determine the identifying features; and
in response to the control agent completing the determination of the identifying features, removing the control agent from the guest VM.
14. The method of claim 13 , wherein inserting the control agent comprises:
writing a driver loader to a memory of the computer system, the driver loader configured to load a control driver into the guest VM, the control driver configured to determine the identifying features; and
configuring the target VM to switch, when a computer program executing within the guest VM issues a system call, from executing the computer program to executing the driver loader.
15. The method of claim 9 , wherein preventing the execution of the target process comprises changing a value of an instruction pointer of the at least one hardware processor, to alter an execution flow of the target process.
16. The method of claim 9 , wherein determining whether the target process is allowed to execute on the client system comprises:
transmitting an indicator of the target process to a remote server computer system; and
in response, receiving the application control policy from the server computer system, the application control policy determined by the server computer system according to the indicator of the target process.
17. A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system configured to execute a set of guest virtual machines (VM), cause the computer system to execute an application control engine, the application control engine executing outside the set of guest VMs, the application control engine configured to:
detect an event indicative of a launch of a target process within a guest VM of the set of guest VMs, wherein the event comprises an item selected from a group consisting of setting up a virtual memory space for the target process, and writing to a data structure used by the at least one hardware processor to perform memory address translations for the target process;
in response to detecting the event, determine according to an application control policy whether the target process is allowed to execute on the computer system, wherein the application control policy maps allowed processes to users of the computer system; and
in response to determining whether the target process is allowed to execute, when the target process is not allowed to execute, prevent an execution of the target process.